Can Your Registrar Hold Your Domain Hostage?

The receipt was in her inbox. $200. Labeled "domain unlock and transfer processing fee." She hadn't signed up for any unlock service. She hadn't agreed to a fee schedule like this. She had simply asked her registrar to release her domain so she could move it to a different company. The registrar's response was: pay this, or wait 60 more days.

She paid. She had a business running on that domain. She couldn't wait.

Here's the thing: what happened to her is not a scam, exactly. It happens inside legal gray areas. And it's more common than the domain industry wants you to know.

The Short Answer Is Yes

Registrars can hold your domain in ways that make transferring it difficult, slow, expensive, or temporarily impossible. Some of these holds are legitimate protections against fraud. Others are revenue mechanisms dressed up as security features.

Knowing the difference matters before you register, not after you've been charged a fee you didn't see coming.

The 60-Day Transfer Lock: Legitimate Rule, Weaponized in Practice

ICANN's Transfer Policy includes a 60-day transfer lock. The rule is real. When any registrant contact information is updated, such as the name, email address, or organization on the account, the domain is automatically locked from transferring to another registrar for 60 days. The stated reason is fraud prevention: if someone hijacks your account and changes the contact information, this lock gives you a window to detect the problem and reverse it before your domain walks out the door.

That's a reasonable policy in theory.

In practice, a contact update can be triggered by things you'd never associate with fraud. Updating your billing email. Correcting a typo in your name. Adding a phone number to your account profile. Any of these can reset the 60-day clock, even if nothing about your actual domain registration changed. And many registrars don't tell you clearly that routine contact updates trigger the lock.

The result: someone who's been a customer for years, who wants to move their domain to a better registrar, suddenly finds themselves in a 60-day mandatory waiting period that started the last time they updated their billing information. No warning. No explanation unless they dig into the transfer policy fine print.

The Five Hostage Tactics Registrars Use

There are specific patterns that show up repeatedly in the forums, Reddit threads, and Hacker News posts that make up the BuzzAbout data on this topic. GoDaddy has 54 keyword mentions in hostage context alone. This isn't isolated to one company.

Paid "Domain Protection" Products That Block Outbound Transfers

Some registrars sell products called "Domain Privacy Plus," "Domain Protection," or variations of that name. The features sound reasonable: block unauthorized transfers, prevent domain hijacking. The problem is that some implementations make outbound transfers deliberately complicated. To initiate a legitimate transfer, you have to first disable the protection, which requires navigating support flows that are not designed to be easy.

Wix's domain protection features, as documented in multiple user reports in the Wix Community Forum and on Reddit's r/webhosting, created a mandatory one-week hold on any outbound transfer even after the protection was disabled. That's a week you didn't agree to.

The "Redemption Grace Period" Fee

When a domain expires, it enters what ICANN calls a Redemption Grace Period (RGP). During this window, registrars can charge a redemption fee to restore the domain. These fees are not standardized. They range from $50 to $200 depending on the registrar.

Here's where this becomes a hostage situation: some registrars allow domains to slip into the RGP more easily than they should, with insufficient renewal reminders or payment processing that fails silently. The domain owner doesn't realize anything happened until the domain is dark. Then they're told: pay the redemption fee, or the domain becomes available to the public.

This is legal. It is also a real incentive for registrars to let domains lapse. The redemption fee is pure margin. See also: domain expires day by day.

The Missing Auth Code

Every domain has an authorization code, sometimes called an EPP code or transfer auth code. To move a domain to a new registrar, you need this code. ICANN requires registrars to provide it within five calendar days of a registrant request. Most registrars comply.

Some don't, or comply at the edge of the five-day window, or send the code to an email address that's no longer current, or make the code retrieval process difficult enough that registrants give up. The Hacker News thread "Gandi is holding my domain hostage: what can I do?" documented exactly this pattern, where repeated auth code requests were either delayed or sent to an inaccessible email.

The "Administrative Review" Hold

Some registrars add their own review window on top of the ICANN-required processes. Transfer requests sit in "administrative review" for days or weeks. There's no ICANN rule requiring this review. It's a registrar-level policy that adds friction to outbound transfers while adding nothing to inbound ones.

UDRP Freeze

This one is less common but more serious. A Uniform Domain-Name Dispute-Resolution Policy proceeding is a legal process for resolving disputes about who should own a domain. When a UDRP complaint is filed against a domain, the domain is frozen. No transfers. No significant DNS changes. The proceeding itself can take 60 days or longer to resolve.

UDRP was designed to address genuine trademark disputes. But the freeze mechanism can be triggered by a complaint. A bad-faith UDRP complaint can lock your domain for months while the case works through the process. You need a lawyer to respond. The registrar has no obligation to accelerate your timeline.

What ICANN Actually Protects You From

Here's the honest picture. ICANN's rules give you some protections, but they don't eliminate the friction.

ICANN requires registrars to provide auth codes within five days. You can file an ICANN complaint if a registrar refuses. ICANN investigates these complaints, and registrars who habitually violate transfer policies can lose their accreditation.

ICANN does not cap the fees registrars charge for transfers, unlocks, or redemptions. ICANN does not require registrars to make the unlock process easy. ICANN does not have jurisdiction over the "administrative review" holds some registrars impose.

The rules set a floor. They don't guarantee a clean experience.

For a clear picture of what your actual rights are as a registrant under ICANN policy, read do you actually own your domain.

What to Check Before You Register

The time to evaluate a registrar's transfer policies is before you register, not the moment you want to leave.

Check whether the registrar charges a transfer fee. Cloudflare, Porkbun, and a few others charge the ICANN wholesale cost for domain registration, with no transfer fees. Many others charge $10-15 to transfer out. It's not a deal-breaker, but it's a signal about how the registrar thinks about your exit.

Search the registrar name plus "hostage," "transfer refused," and "won't release domain." Spend five minutes on Reddit and Hacker News. The complaints are public. The patterns are clear. GoDaddy, Wix, and several others have documented histories of difficult transfer processes. Cloudflare, Namecheap, and Porkbun have cleaner records.

Read the domain protection product terms carefully. If a registrar is selling you a protection add-on, understand exactly what it blocks and what the process is to disable it before a transfer.

Know where your auth code lives. Log in, find the section for your domain, confirm you can access and export the authorization code. If you can't find it in five minutes, that's a problem.

For a full comparison of registrars by transfer policy and long-term reliability, see best domain registrars for long-term ownership.

What to Do Right Now If You're Already Stuck

If you've already been told there's a hold, a fee, or a delay you didn't agree to:

Request the auth code in writing, via email. This creates a timestamp. ICANN's five-day clock starts from the date of your request. If the registrar misses that window, you have the documentation to file an ICANN complaint.

File an ICANN complaint if the registrar doesn't respond. ICANN has a formal complaint process. It's slow. But filing the complaint often accelerates registrar response, because registrars don't want ICANN investigations.

Escalate to your credit card company if you paid a fee you didn't agree to. Unauthorized fees are disputable. Document everything.

Do not let the domain expire while you're in dispute. This is the registrar's leverage. An expiring domain strengthens their position. Keep it renewed throughout the dispute process, even if you're paying a registrar you're trying to leave.

This article is part of the Sprint 2 Registrar Reality cluster. For the related story of what happens when a registrar shuts down entirely rather than just making transfers hard, read what happens when a registrar shuts down.